Hi,
I would like to discuss the concept that we all think our data is safe. If we browse our mail on Google. We see it is HTTPS, and see the nice little padlock and then we feel or fluffy that nobody will ever be able to read our mails as it travels through fibre optics switches across the oceans and many routers and switches.
WARNING: The view expressed here are based on my knowledge acquired from Wired, therefore I cannot guarantee the information on this blog is 100% correct, discretion is advised.
But you wrong?
There are organizations out, specifically in the US that STORE all data traffic coming into various telecommunication hubs such as AT&T.
You might say, so what?
Consider this:
Store Data Now – Crack the encryption later
The NSA (National Security Agency) in the US is storing your encrypted data if it goes via the US. Considering the you do not have total control of how network packets are sent over the Internet, chances are 90% of your data is going via the US data hubs.
You might say that, who cares if they storing your packet level data for encrypted emails. But lets see how they can decrypt it:
Imagine GMAIL:
Look at the size of the encryption that Google mail uses.
1024 Bits.
Ok, so this is a relatively strong encryption of 1024 Bits, which would take the age of several universes to crack on a normal home computer, but on a super computer, things are much more merrier.
Also, if you can get enough DATA using the same Public Key, algorithms on Super Computers can then be used to detect patterns in emails being sent e.g. Hello, Kind Regards etc. With these patterns, the Super Computer and increase its chances in cracking the private key.
Let’s take an example of the RSA 1024 Bit encryption (yes same that GMAIL uses) that was cracked on 7th January 2010. The ONE requirement for the pattern matching to work is that the email messages or data sent is using the SAME public/private key pair.
Source: RSA 1024 Cracked
The RSA crack this time, was achieved by Valeria Bertacco, Todd Austin and Andrea Pellegrini. They varied the voltage levels at the sender end to make faulty encryptions. This helped them recreate the private key by combining a number of fragments, achieved in the process. The complete operation took 100 hours. A quote from the research paper says, First, we develop a systematic fault-based attack on the modular exponentiation algorithm for RSA. Second, we expose and exploit a severe flaw on the implementation of the RSA signature algorithm on OpenSSL, a widely used package for SSL encryption and authentication. Third, we report on the first physical demonstration of a fault-based security attack of a complete microprocessor system running unmodified production software: we attack the original OpenSSL authentication library running on a SPARC Linux system implemented on FPGA, and extract the system’s 1024-bit RSA private key in approximately 100 hours.
This breaks the backbone of RSA which believes that as long as the private key is safe, it is impossible to break in, unless guessed.
Ok, the above is not how the NSA cracks work, but servers as an example. If you can find a PATTERN, then you improve the probabilities of cracking, and this is done by the assumption that your private/public key does not change often.
Data Mining
Ok, so the NSA has your historical emails, online banking etc. So, how do they crack it, first they would collect hundreds of emails sent to a particular recipient and run algorithms for common patterns, then this can get fed into a super computer.
Now, what super computer. Well, they have a few, the latest one is spanned across two buildings, consuming power to light up 200, 000 homes! It is near their current facility on the East Campus of Oak Ridge.
Another super computer ready by the end of 2013 is called CASCADE, developed in tangent with Cray, this new super beast can run at speeds of 20 petaflops!
Government Legislation
What should change, because, ultimately we are supposed to live a democratic society? Laws should be passed to prevent any organisation from storing data and especially prohibit the storage of encrypted data.
What can we do
Very simple. To make the algorithms weak that they use to detect patterns in several messages
1. Prevent the algorithm from using patterns to improve the chance of cracking the encryption key by CHANGING your public/private key pairs often.
2. For very secure data use an email provider that is NOT hosted in the US. Check this with visual TraceRoute/Tracert tools.
3. Zip the contents of secure data and encrypt that over the HTTPS encryption in your email system
4. Create your own Self Hosted Email System that is NOT HOSTED in the US.
5. Use your OWN certificate server and share the Root CA with the people you need to send secure data to. E.g. Financial Intuitions (Letter of Credits etc.). Then build a PowerShell script to generate new Private/public keys randomly and email this to your SECURE member network. VERY important that they generated at random times throughout the day, since if you pick a specific date/time, then the crackers can use this to ESTIMATE when they change and only using data in that window to run pattern matching. Then use a syncing automate system that sends out the new public key to the recipients that automatically use a script or bot to load it into their KEY STORE.
6. DO NOT USE LAND LINES or Mobile Phone contract SIM cards for personnel/intimate calls via the US, they all get filtered and analysed. Use a Pay as You Go. It is not fool proof but helps. Allot of journalists personnel lives are known to the NSA and many other people that travel, your phone is not safe, remember that, it goes through a network exchange, it is easy to pick voice calls and store it!
By doing the above and changing Private Key often in an automated fashion, you will prohibit the best algorithms from trying to crack your data. The NSA will have no way of knowing what the schedule is of your Public/Private key regeneration is, thus the algorithm will make assumptions that the next hours worth of data is on the same key pair etc., and will just be running down a dead end.
Microsoft’s Cloud
One thing I noted with Microsoft Windows Azure’s Cloud, is even though you can set an affinity for a region out of the US, e.g. Singapore, the data going to and from your cloud hosted site in Singapore is going via the US! Here is the proof.
Consider this trace I did from Sydney to Singapore, it went VIA the US!
The General Public and End User
Not all users of the internet are geeks like us, so how can we help them. We build an Open Source Application that manages dynamic Public/Private Key pairs and a syncing notification system with a secure public key delivery mechanism, which in itself is extremely complicated, perhaps when I have some time, we can come up with a demo.
Summary
I hope I have revealed to you that your data is not safe and secure, there are Organisations out there that break all the laws and are allowed to and one of them is the NSA, your data in the next few years will be stored in a HUGE data centre in the UTAH Dessert. As we speak the data centre being built in the UTAH dessert is going along smoothly..
PROTECT your most intermit data with the tips I have given here. Just because 0.01% of the population is bad does not mean the rest of use must be compromised and our privacy VIOLATED. It is an absolute disgrace where our society is heading in regards to privacy laws. Nobody has the right to listen in on your private phone calls, emails etc. And NOBODY has the right to store all your historic data, waiting until technology is powerful enough to decrypt it.
WARNING: The view expressed here are based on my knowledge acquired from Wired, therefore I cannot guarantee the information on this blog is 100% correct, discretion is advised.
NOTHING IS SECURE
